After this course you can lead a security incident from the first report through to post-incident work: assess the situation, secure evidence, contain, clean up and document properly. You will know how malware, email, web and cloud incidents differ and how to approach each one. The course suits you if you have worked in cybersecurity for at least a year and want to take on more responsibility when incidents happen.
What you’ll take away.
- Apply the full incident handling process with confidence
- Act as a first responder and secure evidence without altering it
- Contain incidents across networks, web, email, cloud and endpoints
- Recognise insider threat scenarios and escalate them properly
Your training in detail
- Who is it for?
- Security professionals with practical experience who want to handle incidents independently or strengthen an incident response team.
- Prerequisites
- At least one year of work experience in cybersecurity, as EC-Council requires. The course is not intended for beginners.
- Format & planning
- Standard length: 3 training days. A different length can be arranged for companies.
Agenda: from understanding to application
Our independently developed agenda proposal. Focus areas, lab environment and scope are agreed before booking.
Incident handling fundamentals and process
First response and evidence handling
Malware and email incidents
Network and web application incidents
Cloud incidents
Insider threats and endpoints including mobile, IoT and OT
You take a simulated phishing incident from first report to final write-up and decide on containment and communication.
Exams, licences & credentials
This course prepares you for the EC-Council ECIH exam. The exam and its fees are included only if your offer confirms them. The certificate is issued by EC-Council, not NextNowa. This is not an official EC-Council course. EC-Council sets the exam eligibility rules, so check your route with EC-Council before you book.
Vendor references & review date
Sources checked on 2026-11-04. These sources describe the technology or external exam requirements. They do not imply a partnership with NextNowa.
Your learning content
These objectives describe the training topic. The specific syllabus, dates and trainer are agreed before booking; the written offer is binding.
Frequently asked questions
What is the ECIH exam like?
EC-Council lists 100 multiple-choice questions in three hours, taken through its own exam portal.
Is the course suitable for beginners?
No. EC-Council expects at least one year of cybersecurity experience. Start with a fundamentals course if you are new to the field.
Does EC-Council Certified Incident Handler (ECIH): handling incidents include a certificate?
This course prepares you for the EC-Council ECIH exam. The exam and its fees are included only if your offer confirms them. The certificate is issued by EC-Council, not NextNowa. This is not an official EC-Council course. EC-Council sets the exam eligibility rules, so check your route with EC-Council before you book.